Unsecured Fluid View in TYPO3 Extension Allows Malicious Template Execution

CVE-2026-77136

What is CVE-2026-77136?

The TYPO3 Powermail extension contains a vulnerability that allows an unauthenticated user to inject arbitrary Fluid template syntax into a form field without any input sanitization. This oversight enables attackers to execute malicious Fluid ViewHelpers, potentially leading to the exposure of sensitive information such as server configurations, environment variables, and application source code. Exploitation is straightforward, as it only requires configuring a form field as the sender_name, which is a common default setup in Powermail. This vulnerability has been reported as actively exploited, making it imperative for users to promptly apply the necessary security updates.

References